Stored HTML Injection in MasterStudy LMS WordPress Plugin

Executive Summary

The MasterStudy LMS WordPress Plugin before version 3.7.50 has a stored HTML injection vulnerability. Users with subscriber-level access or higher can inject malicious HTML code, such as iframes, into course discussions. The plugin fails to properly sanitize and restrict HTML in user-submitted content before storing and displaying it to others.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the MasterStudy LMS WordPress plugin. If it is below 3.7.50, the system is vulnerable. Look for suspicious HTML content in user-submitted areas like course discussions, which may include iframes or other injected scripts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be leveraged for phishing attacks and content spoofing. Attackers could embed malicious iframes or other HTML elements that trick users into revealing sensitive information or believing false content. Users viewing the injected content may be redirected to harmful websites or see spoofed information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling phishing attacks or content spoofing through injected HTML. If user data is compromised or manipulated, it may violate confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the MasterStudy LMS plugin to version 3.7.50 or later immediately. Review user-submitted content for any malicious HTML injections, especially in course discussions. Consider restricting subscriber-level access to trusted users until the update is applied.

Useful 0 Not Useful 0